GitHub Advisoryadvisory · Go
GHSA-846m-99qv-67mg Ollama can extract members of a ZIP archive outside of the parent directory
HIGH
Official page ↗
- Aliases
- CVE-2024-45436
- Ecosystem
- Go
- Packages
- github.com/ollama/ollama
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2024-08-29
Affected packages
• Go github.com/ollama/ollama: < 0.1.47 → fixed in 0.1.47
Description
`extractFromZipFile` in `model.go` in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.
Related
Alias · CVE (1)
- CVE-2024-45436 extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness